I understand this is just not legal, but otherwise why should they had not (i.e. why exactly is it illegal)? What the rationally logical plan they should have taken? Telling everyone about the vulnerability is irrational - it should be told to those who are supposed to write patches first, keeping the shares when you know they are going down is irrational too.
Edit: to say it differently, it's only irrational if you consider his personal profit exclusively and not the harm to the greater market and shareholders. As con artists and scammers demonstrate, fraud can be very profitable personally. I think the disadvantages are self-evident, however.
Which is why we have insider trading laws: to make it rational again.
"I know this insider information that means my shares will be worthless tomorrow when everyone finds out. It's not rational to keep them."
"If you do that you'll go to prison."
Still irrational?
I'd say a large portion of rules of society function this way for this reason.